[chuckup]

And what if the sender does not send the key? Or, when you use the key, you find out it is just a blob of zeros? (Or, the other way around: receiver lies and says that the sender did not send the key, or that the decrypted data did not match the hash)

[moe]

All your concerns are valid but addressable via "reputation".

Consider this: Each completed transaction is rated by each participating party.

How much your rating affects your opponents reputation in determined by your own reputation. A higher reputation enables privileges such as more peers willing to trade with you, faster downloads, etc.

These reputation systems don't work in common P2P networks because everyone can just generate fake identities and boost their own reputation at will.

However, if you tie the reputation system to bitcoin so that the creation of an identity puts actual money on the line then this kind of cheating doesn't work anymore.